CVE-2019-25381

Name of the Vulnerable Software and Affected Versions Smoothwall Express version 3.1-SP4-polar-x86 64-update9

Description The software contains multiple reflected cross-site scripting issues within the hosts.cgi script. Attackers can inject malicious scripts through unvalidated parameters. Specifically, attackers can send POST requests to the ''/hosts.cgi'' endpoint with script payloads in the IP, HOSTNAME, or COMMENT parameters, leading to the execution of arbitrary JavaScript in users' browsers.

Recommendations Apply input validation and sanitization to the IP, HOSTNAME, and COMMENT parameters in the hosts.cgi script.